Exabeam

Exabeam is a scaled, PE-backed consolidator in the SIEM and security-analytics market, and its 2024 merger with LogRhythm — engineered by owner Thoma Bravo — created a combined company with a large installed base, broad geographic reach, and the revenue heft to compete for enterprise SOC platform deals. Exabeam pioneered applying user and entity behavior analytics on top of SIEM, and behavioral analytics is exactly the capability that matters most as identity-based attacks dominate the threat landscape; that UEBA heritage differentiates it in a market where raw log aggregation is commoditizing. Under CEO Chris O'Malley the combined entity markets an AI-driven security-operations platform spanning SIEM, analytics, UEBA, and automation, and the SIEM market is in genuine upheaval — Cisco's acquisition of Splunk, Google's of Mandiant/Chronicle, and pricing revolts against legacy ingestion-based licensing have all put large books of business in motion, creating a displacement opportunity for a focused alternative. The agentic-AI wave gives Exabeam a path to modernize the SOC-analyst workflow atop its analytics engine. As a profitable-scale, Thoma Bravo–backed platform with real behavioral IP and a merged customer base to cross-sell, Exabeam is positioned to consolidate mid-market and enterprise SIEM budgets that are actively looking for a new home.

Exabeam's merger with LogRhythm is the kind of PE roll-up that looks tidy on a slide and is brutal in execution: fusing two overlapping SIEM platforms, product roadmaps, and sales cultures while retaining customers is a multi-year integration risk, and combining two slower-growth assets does not automatically create a fast-growing one — it can simply create a larger company with the same structural headwinds. And the headwinds are severe. SIEM is being attacked from every direction: Microsoft Sentinel bundles cloud-native SIEM into the Azure/E5 estate, CrowdStrike and Palo Alto push next-gen SIEM into their platform bases, Google Chronicle brings hyperscale economics, and Cisco-owned Splunk remains the entrenched enterprise leader — while nimble challengers like Panther and Securonix pressure the mid-market Exabeam depends on. Against that field, a merged legacy vendor risks being the option enterprises leave rather than the one they migrate to. Thoma Bravo's ownership implies a mandate to optimize for cash flow and an eventual exit, which can starve the heavy R&D reinvestment needed to keep pace with hyperscaler-funded competitors. Legacy SIEM licensing and architecture are precisely what the market's pricing revolt is fleeing, and a company assembled from two incumbents in a category being disrupted by cloud-native and AI-native entrants may find itself defending a shrinking base rather than consolidating a growing one.